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Abstract 

We consider a secure lossless source coding problem with a rate-limited helper. 

c/3 ', In particular, Alice observes an i.i.d. source X n and wishes to transmit this source 

losslessly to Bob at a rate R x . A helper, say Helen, observes a correlated source Y n and 

fSj . transmits at a rate R y to Bob. A passive eavesdropper can observe the coded output of 

Alice. The equivocation A is measured by the conditional entropy H(X n \J x )/n, where 

I/") . J x is the coded output of Alice. We first completely characterize the rate-equivocation 

C — ■ 

. region for this secure source coding model, where we show that Slepian-Wolf type 

O . coding is optimal. 

We next study two generalizations of this model and provide single-letter charac- 
terizations for the respective rate-equivocation regions. In particular, we first consider 
the case of a two-sided helper where Alice also has access to the coded output of Helen. 
^ ■ We show that for this case, Slepian-Wolf type coding is suboptimal and one can further 

decrease the information leakage to the eavesdropper by utilizing the side information 
at Alice. We finally generalize this result to the case when there are both secure and in- 
secure rate-limited links from Helen and additional uncoded side informations W n and 
Z n are available at Bob and Eve, respectively. For this model, we provide a complete 
characterization of the rate-equivocation region when Y n — » X n — > (W n , Z n ) forms a 
Markov chain. 



*This work was supported by NSF Grants CCF 04-47613, CCF 05-14846, CNS 07-16311 and CCF 07 - 
29127, and presented in part at the 47th Annual Allcrton Conference on Communications, Control and 
Computing, Monticello, IL, September 2009. 



1 Introduction 



The study of information theoretic secrecy was initiated by Shannon in [1] . Following Shan- 
non's work, significant contributions were made by Wyner [2] who established the rate- 
equivocation region of a degraded broadcast channel. Wyner's result was generalized to the 
case of a general broadcast channel by Csiszar and Korner [3]. Recently, there has been a 
resurgence of activity in studying multi-terminal and vector extensions of [2], [3]. 

In this paper, we investigate a secure transmission problem from a source coding perspec- 
tive. In particular, we first consider a simple setup consisting of four terminals. Terminal 1 
(say Alice) observes an i.i.d. source X n which it intends to transmit losslessly to terminal 
2 (say Bob). A malicious but passive user (say Eve) gets to observe the coded output of 
Alice. In other words, the communication link between Alice and Bob is public, i.e., inse- 
cure. It is clear that since the malicious user gets the same information as the legitimate 
user, there cannot be any positive secret rate of transmission. On the other hand, if there 
is a helper, say Helen, who observes an i.i.d. source Y n which is correlated with the source 
X n and transmits information over a secure rate-limited link to Bob, then one can aim for 
creating uncertainty at the eavesdropper (see Figure ft. For the model shown in Figure 1, 
we completely characterize the rate-equivocation region. From our result, we observe that 
the classical achievablity scheme of Ahlswede and Korner [4] and Wyner [5] for source coding 
with rate-limited side information is robust in the presence of a passive eavesdropper. 

Secondly, we consider the model where Alice also has access to the coded output of 
Helen and completely characterize the rate-equivocation region. We will call this model the 
two-sided helper model (see Figure 2). From our result, we observe that the availability of 
additional coded side information at Alice allows her to increase uncertainty of the source at 
Eve even though the rate needed by Alice to transmit the source losslessly to Bob remains 
the same. This observation is in contrast with the case of insecure source coding with side 
information where providing coded side information to Alice is of no value [4] . 

We next generalize the setup of Figure 2 to the case when there are both secure and 
insecure rate-limited links from Helen and there is additional side information W n at Bob 
and additional side information Z n at Eve. In particular, there is a secure link of capacity 
R sec , whose output is available at Alice and Bob and an insecure link, of capacity Ri ns , 
whose output is available at all three terminals, i.e., at Alice, Bob and Eve (see Figure 3). 
The presence of both secure and insecure links from Helen can be interpreted as a source- 
coding analogue of a degraded broadcast channel from Helen where Alice and Bob receive 
both secure and insecure streams J sec and Jj ns , whereas, Eve only receives the insecure 
stream J ins . We completely characterize the rate-equivocation region for this model when 
Y n _> X n (W n , Z n ) forms a Markov chain. 

We explicitly compute the rate-equivocation region for the cases of one-sided helper and 

1 In Figures 1, 2 and 3, secure links are shown by bold lines. 
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Figure 1: One-sided helper. 



Figure 2: Two-sided helper. 



two-sided helper for a pair of binary symmetric sources. We show that having access to 
Helen's coded output at Alice yields a strictly larger equivocation than the case of one-sided 
helper. 



2 Related Work 

The secure source coding setup shown in Figure 1 was considered in [6] where it was also 
assumed that Eve has access to additional correlated side information Z n . Inner and outer 
bounds for the rate-equivocation region were provided for this setup, which do not match in 
general. The rate-equivocation region was completely characterized in [6] for the case when 
Bob has complete uncoded side information Y n and Eve has additional side information Z n . 
This result also follows from [7] where a similar three terminal setup was studied and the 
maximum uncertainty at Eve was characterized under the assumption of no rate constraint 
in the lossless transmission of the source to Bob. A similar model was also studied in [8] 
where Bob intends to reconstruct both X n and Y n losslessly. It was shown that Slepian-Wolf 
type coding suffices for characterizing the rate-equivocation region when the eavesdropper 
does not have additional correlated side information. This setup was generalized in [9] to the 
case when the eavesdropper has additional side information Z n , and inner and outer bounds 
were provided, which do not match in general. 

In [10], a multi-receiver secure broadcasting problem was studied, where Alice intends 
to transmit a source X n to K legitimate users. The fcth user has access to a correlated 
source Y" fe n , where F fc n = X n © for k — 1, ... K, and the eavesdropper has access to Z n , 
where Z n = X n © E n , and the noise sequences (B™, . . . , B^, E n ) are mutually independent 
and also independent of the source X n . Furthermore, it was assumed that Alice also has 
access to (Y™, . . . Yg)- For sources with such modulo-additive structure, it was shown that to 
maximize the uncertainty at the eavesdropper, Alice cannot do any better than describing the 
error sequences (B™, . . . , B^) to the legitimate users. This model is related to the two-sided 
helper model shown in Figure 2; see Section 5 for details. 

For the model shown in Figure 3, when we set R sec = Ri ns = 0, i.e., in the absence of 
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Figure 3: Secure and insecure links from two-sided helper. 

Helen, we recover the result obtained in [7]. Therefore, our result can also be viewed as a 
generalization of the result obtained in [7] . 

By setting R sec = 0, i.e., in the absence of the secure rate-limited link, the resulting model 
is related to the model considered in [11] where the aim is to generate a secret key between 
two terminals via an insecure rate-limited two-sided helper. In the model studied in this 
work, the aim is to securely transmit the source X n to Bob. Note that, when R sec = and 
W = 0, both the secret key generation capacity [11] and secure transmission rate are zero 
since Eve has access to both Ji ns and J x along with Z n . On the other hand, in the presence 
of a secure link, i.e., when R sec > 0, even when W = <f), we can still create uncertainty at the 
eavesdropper. This is possible since Helen can choose not to transmit any information on 
the insecure link and transmit only a coded description of Y n by using the secure link at the 
rate R sec , which plays the role of a correlated key. Furthermore, being correlated with the 
source X n , the coded description of Y n also permits Alice to lower the rate of transmission 
when compared to the case of using an uncorrelated secret key, where Alice transmits at a 
rate H(X). 



3 Summary of Main Results 

In Section 4, we present the rate-equivocation region for the case of one-sided helper. We 
show that Slepian-Wolf type coding alone at Alice is optimal for this case. We present 
the rate-equivocation region for the case of two-sided helper in Section 5. For the case 
of two-sided helper, Alice uses a conditional rate-distortion code to create an auxiliary U 
from the source X and the coded output V received from Helen. This code construction is 
reminiscent of lossy-source coding with two-sided helper [12], [13], [14]. For the case of lossy 
source coding, a conditional rate-distortion code is used where U is selected to satisfy the 
distortion criterion. On the other hand, the purpose of U in secure lossless source coding is to 
confuse the eavesdropper. From this result, we demonstrate the insufficiency of Slepian-Wolf 
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type coding at Alice by explicitly utilizing the side information at Alice. This observation 
is further highlighted in Section 6 where we compare the rate-equivocation regions of two- 
sided helper and one-sided helper cases for a pair of binary symmetric sources. For this 
example, we show that for all R y > 0, the information leakage to the eavesdropper for the 
two-sided helper is strictly less than the case of one-sided helper. We finally generalize the 
result of two-sided helper to the case when there are both secure and insecure rate-limited 
links from the two-sided helper and additional side informations W and Z, at Bob and Eve, 
respectively. The presence of secure and insecure rate-limited links from Helen can be viewed 
as a source-coding analogue of a degraded broadcast channel from Helen to (Alice, Bob) and 
Eve. We characterize the rate-equivocation region for this model when the sources satisfy 
the condition Y -> X -> (W, Z). 

4 One-Sided Helper 

4.1 System model 

We consider the following source coding problem. Alice observes an n-length source sequence 
X n , which is intended to be transmitted losslessly to Bob. The coded output of Alice can be 
observed by the malicious user Eve. Moreover, Helen observes a correlated source Y n and 
there exists a noiseless rate-limited channel from Helen to Bob. We assume that the link 
from Helen to Bob is a secure link and the coded output of Helen is not observed by Eve 
(see Figure 1). The sources (X n ,Y n ) are generated i.i.d. according to p(x,y) where p(x,y) 
is defined over the finite product alphabet X x y. The aim of Alice is to create maximum 
uncertainty at Eve regarding the source X n while losslessly transmitting the source to Bob. 

An (n, 2 nRx , 2 nRy ) code for this model consists of an encoding function at Alice, f x : 
X n — > {1, . . . , 2 nRx }, an encoding function at Helen, f y : Y n — > {1, . . . , 2 nRy }, and a decoding 
function at Bob, g : {1, . . . , 2 nRx } x {1, . . . , 2 nRy } — > X n . The uncertainty about the source 
X n at Eve is measured by H(X n \f x (X n ))/n. The probability of error in the reconstruction 
of X n at Bob is defined as P e n = Pr(g(f x (X n ), f y (Y n )) ^ X n ). A triple (R x , R y , A) is 
achievable if for any e > 0, there exists a (n, 2 nRx , 2 nRy ) code such that P e n < e and 
H(X n \f x (X n ))/n > A. We denote the set of all achievable (R x ,R y ,A) rate triples as 

7^-1— sided- 

4.2 Result 

The main result is given in the following theorem. 

Theorem 1 The set of achievable rate triples 7Zi~ S ided f or secure source coding with one- 
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sided helper is given as 



7^-1— sided 



[(R x ,R y ,A):R x >H(X\V) 
R y >I(Y;V) 
A<I(X;V)} 



(1) 
(2) 
(3) 



where the joint distribution of the involved random variables is as follows, 



p(x,y,v) =p(x,y)p(v\y) 



(4) 



and it suffices to consider such distributions for which \V\ < \y\ + 2. 

The proof of Theorem 1 is given in the Appendix. 

We note that inner and outer bounds for source coding model considered in this section 
can be obtained from the results presented in [6] although these bounds do not match in 
general. These bounds match when Bob has complete uncoded side information Y n , i.e., 
when R y > H(Y). 

The achievability scheme which yields the rate region described in Theorem 1 is summa- 
rized as follows: 

1. Helen uses a rate-distortion code to describe the correlated source Y to Bob. 

2. Alice performs Slepian-Wolf binning of the source X with respect to the coded side 
information at Bob. 

Therefore, our result shows that the achievable scheme of Ahlswede, Korner [4] and Wyner [5] 
is optimal in the presence of an eavesdropper. Moreover, on dropping the security constraint, 
Theorem 1 yields the result of [4], [5]. 



5.1 System model 

We next consider the following generalization of the model considered in Section 4. In this 
model, Alice also has access to the coded output of Helen besides the source sequence X n (see 
Figure 2). An (n, 2 nRx ,2 nRy ) code for this model consists of an encoding function at Alice, f x : 
X n x {1, . . . , 2 nR y} -> {1, . . . , 2 nR *}, an encoding function at Helen, f y : Y n -> {1, . . . , 2 nR y}, 
and a decoding function at Bob, g : {1, . . . , 2 nRx } x {1, . . . , 2 nRy } — > X n . The uncertainty 
about the source X n at Eve is measured by H(X n \f x (X n ))/n. The probability of error in 
the reconstruction of X n at Bob is defined as P e n = Pr(g(f x (X n , f y {Y n )), f y (Y n )) ^ X n ). A 
triple (R X) R y , A) is achievable if for any e > 0, there exists a (n, 2 nRx , 2 nRy ) code such that 



5 Two-Sided Helper 
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P e n < e and H(X n \f x (X n ))/n > A. We denote the set of all achievable (R x , R y , A) rate 
triples as TZ 2 - S ided- 

5.2 Result 

The main result is given in the following theorem. 

Theorem 2 The set of achievable rate triples 712-sided for secure source coding with two- 
sided helper is given as 

K 2 - Sided = [(R x , R y , A):R X > H(X\V) (5) 

R y > I(Y; V) (6) 
A < mm(I(X; V\U), (7) 

where the joint distribution of the involved random variables is as follows, 

p(x, y, v, u) = p(x, y)p(v\y)p(u\x, v) (8) 

and it suffices to consider distributions such that \V\ < \y\ + 2 and \U\ < \X\\y\ + 2\X\. 

The proof of Theorem 2 is given in the Appendix. We remark here that the proof of converse 
for Theorem 2 is closely related to the proof of the converse of the rate-distortion function 
with a two-sided helper [12], [13], [14]. 

The achievability scheme which yields the rate region described in Theorem 2 is summa- 
rized as follows: 

1. Helen uses a rate-distortion code to describe the correlated source Y to both Bob and 
Alice through a coded output V . 

2. Using the coded output V and the source X, Alice jointly quantizes (X, V) to an 
auxiliary random variable U. She subsequently performs Wyner-Ziv coding, i.e., bins 
the U sequences at the rate I(X; U\V) such that Bob can decode U by using the side 
information V from Helen. 

3. Alice also bins the source X at a rate H(X\U,V) so that having access to (U,V), 
Bob can correctly decode the source X. The total rate used by Alice is I(X; U\V) + 
H(X\U,V) = H(X\V). 

Therefore, the main difference between the achievability schemes for Theorems 1 and 2 is at 
the encoding at Alice and decoding at Bob. Also note that selecting a constant U in Theorem 
2 corresponds to Slepian-Wolf type coding at Alice which resulted in an equivocation of 
I(X;V) in Theorem 1. We will show in the next section through an example that the 
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uncertainty about the source at Eve for the case of two-sided helper can be strictly larger 
than the case of one-sided helper and selecting U as a constant is clearly suboptimal. 

Besides reflecting the fact that the uncertainty at Eve can be strictly larger than the 
case of a one-sided helper, Theorem 2 has another interesting interpretation. If Alice and 
Helen can use sufficiently large rates to securely transmit the source X n to Bob, then the 
helper can simply transmit a secret key of entropy H(X) to both Alice and Bob. Alice 
can then use this secret key to losslessly transmit the source to Bob in perfect secrecy by 
using a one-time pad [1]. In other words, when R x and R y are larger than H(X), one can 
immediately obtain this result from Theorem 2 by selecting V to be independent of (X, Y) 
and uniformly distributed on {1, . . . , 1^1}. Finally, selecting U = X © V, we observe that 
min (R y , I (X; V\U)) = H(X), yielding perfect secrecy. We note that, here, V plays the role 
of a secret key. 

Now consider the model where the side information Y n is of the form Y n = X n © B n , 
where \B\ = \X\, and B n is independent of X n . Moreover, assume that the side information 
Y n is available to both Alice and Bob in an uncoded manner. For this model, it follows 
from [10] that, to maximize the uncertainty at the eavesdropper, Alice cannot do any better 
than describing the error sequence B n to Bob. Note that our two-sided helper model differs 
from this model in two aspects: first, in our case, the common side information available to 
Alice and Bob is coded and rate-limited, secondly, the sources in our model do not have to 
be in modulo-additive form. 

Our encoding scheme at Alice for the case of two-sided helper comprises of two steps: 
(a) using the coded side information V and the source X, Alice creates U and transmits the 
bin index of U at a rate I(X; U\V) so that Bob can estimate U using V, and, (b) Alice bins 
the source X at a rate H(X\U, V) and transmits the bin index of the source X. Note that 
if for a pair of sources (X,Y), the optimal V is of the form V — X © B, where \B\ = \X\ 
and B is independent of X, then it suffices to choose U = B, so that I(X; V\U) = H(X) 
and H(X\U,V) = 0. In other words, for such sources, step (b) in our achievability scheme 
is not necessary, which is similar to the achievability for the case of modulo-additive sources 
in [10]. On the other hand, for a general pair of sources (X, Y), the optimal V may not be of 
the form V = X © B and the optimal U may not always satisfy H(X\U, V) = 0. Therefore, 
we need the step (b) for our achievability scheme. This differentiates our achievable scheme 
from that of [10], which holds for modulo-additive sources with uncoded side information. 

Also note that if Y n is not of the form X n © B n , and if R y > H(X), then Helen can 
transmit a secret key which will enable perfectly secure transmission of X n by using a one- 
time pad [1]. This phenomenon does not always occur when the side information Y n is 
available to both Alice and Bob in an uncoded fashion [10]. 
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6 An Example: Binary Symmetric Sources 



Before proceeding to further generalizations of Theorems 1 and 2, we explicitly evaluate 
Theorems 1 and 2 for a pair of binary sources. 

Let X and Y be binary sources with X ~ Ber(l/2), Y ~ Ber(l/2) and X = Y (BE, where 
E ~ Ber(<5). For this pair of sources, the region described in Theorem 1 can be completely 
characterized as, 

n^ slded {R y ) = {(R x , A) : R x > h{5*h-\l-R y )) 

A < 1 -h(5*hr\l -R y ))} (9) 

and the region in Theorem 2 can be completely characterized as, 

K 2 - sided (Ry) = {(R x , A) : R x > h(5 * h-\l - R y )) 

A<mm(R y , 1)} (10) 

where h(.) is the binary entropy function, and a* b = a(l — b) + b(l — a). 

We start with the derivation of ([9]). Without loss of generality, we assume that R y < 
H(Y). Achievability follows by selecting V = Y © N, where N ~ Ber(a), where 

a = h-\l- R y ) (11) 

Substituting, we obtain 

H(X\V) = h(5* h-\l -R y )) (12) 

I(X;V) = 1 - h(6* h-\l - R y )) (13) 

which completes the achievability. Converse follows by simple application of Mrs. Gerber's 
lemma [15] as follows. Let us be given R y 6 (0, 1). We have 

R y > I(Y- V) (14) 
= H(Y) - H(Y\V) (15) 
= 1-H(Y\V) (16) 

which implies H(Y\V) > 1 — R y . Mrs. Gerber's lemma states that for X = Y © E, with 
E ~ Ber(5), if H(Y\V) > (3, then H{X\V) > h(5 * h-\f3)). We therefore have, 

R x > H(X\V) (17) 
>h(5*h- 1 (l-R y )) (18) 
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and 



A<I(X;V) (19) 

= H(X)-H(X\V) (20) 

= 1-H(X\V) (21) 

< l-h(8*h-\l-Ry)) (22) 

This completes the converse. 

For the case of two-sided helper, we compute the equivocation A as follows. We choose 
V as V = Y © N where N ~ Ber(o;) as in the case of one-sided helper. We choose U as, 

U = X®V (23) 

We next compute the term I(X;V\U) as follows, 

I(X;V\U) = I(X;V\X ®V) (24) 

= H(X,X@V)-H(X@V) (25) 

= H(X) + H(V\X)-H(X@V) (26) 

= H{X) + H(Y © N\X) - H{X © Y © N) (27) 

= H{X) + H(X ® E ® N\X) — H(X ® X ® E ® N) (28) 

= H{X) (29) 

= 1 (30) 

and therefore 

mm(R y , I(X; V\U)) = mm(R y , 1) (31) 

For the converse part, we also have that 

A < mm(R y , I(X; V\U)) (32) 
< min^, if (X)) (33) 
= m.m(R y , 1) (34) 

The rate from Alice, R x and the equivocation A for the cases of one-sided and two-sided 
helper are shown in Figure 4 for the case when 8 = 0.05. For the one-sided helper, we can 
observe a trade-off in the amount of information Alice needs to send versus the uncertainty 
at Eve. For small values of R y , Alice needs to send more information thereby leaking out 
more information to Eve. The amount of information leaked is exactly the information 
sent by Alice. On the other hand, for the case of two-sided helper, the uncertainty at the 
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Figure 4: The rate-equivocation region for a pair of binary symmetric sources. 

eavesdropper is always strictly larger than the uncertainty in the one-sided case. Also note 
that for this pair of sources, perfect secrecy is possible for the case of two-sided helper when 
R y > H(Y) which is not possible for the case of one-sided helper. 

7 Secure and Insecure Links from Two-Sided Helper 
7.1 System model 

In this section, we consider a generalization of the model considered in Section 5. We 
consider the case when there are two links from Helen (see Figure 3). One link of rate R sec 
is secure, i.e., the output of this link is available to only Alice and Bob. The second link 
of rate Ri ns is public and the output of this link is available to Alice, Bob and Eve. The 
sources (X n ,Y n ,W n , Z n ) are generated i.i.d. according to p(x,y,w,z) = p(x,y)p(w, z\x) 
where p(x, y, w, z) is defined over the finite product alphabet X x y x W x Z. 

A (n, 2 nRx , 2 nRaec , 2 nRms ) code for this model consists of an encoding function at He- 
len, f y : Y n -> J sec x J ins , where |J sec | < 2 nRsec , \J ins \ < 2 nRins , an encoding func- 
tion at Alice, f x : X n x J sec x J ins — > {1, . . . , 2 nRx }, and a decoding function at Bob, 
g : {1, . . . , 2 nRx } x J sec x J ins x W n — > X n . The uncertainty about the source X n at Eve is mea- 
sured by H(X n \f x (X n , J sec , Jins), Ji ns , Z n )/n. The probability of error in the reconstruction 
of X n at Bob is defined as P e n = Pr(g(f x (X n , J sec , J ins ), Jsec, Jins, W n ) £ X n ). A quadruple 
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(R x , R sec , R ins , A) is achievable if for any e > 0, there exists a (n, 2 nRx , 2 nRaec , 2 nRina ) code 
such that P™ < e and i7(X n |/ a .(A' n , J sec , J ins ), J ins , Z n )/n > A. We denote the set of all 
achievable (R x , R sec , Rins, A) rate quadruples as TZ^,f_ ins . 

7.2 Result 

The main result is given in the following theorem. 

Theorem 3 The set of achievable rate quadruples TZ^f_ ins for secure source coding with 
secure and insecure links from a two-sided helper, additional side information W at Bob and 
Z at Eve is given as 

Kec-ins = Rsec, R t ns, A) : R x > H(X\V U V 2 , W) (35) 

Rscc>I(Y;V 1 \W) (36) 
R ins >I(Y;V 2 \W,V 1 ) (37) 
A<min( J R sec ,/(X;\/ 1 |f/,y 2 ,^)) 

+ I(X;W\U,V 2 )-I(X;Z\U,V 2 )} (38) 
where the joint distribution of the involved random variables is as follows, 

p(x, y, w, z, vi, v 2 , u) = p(x, y)p(w, z\x)p(v 1 ,v 2 \y)p(u\x, v 1 , v 2 ) (39) 
and it suffices to consider such distributions for which |Vi| < \y\ + 3, \V 2 \ < \y\ + 4 and 

\u\ < \x\\y\ 2 + 7\x\\y\ + i2\x\ + 2. 

The proof of Theorem 3 is given in the Appendix. 

The achievability scheme which yields the rate region described in Theorem 3 is summa- 
rized as follows: 

1. Helen first uses the secure link to describe the source Y to both Alice and Bob at 
a rate J(Y;Vi|W), where W plays the role of side information. Subsequently, the 
insecure link is used to provide another description of the correlated source Y at a rate 
I(Y; V 2 \W, Vi), where (W, Vi) plays the role of side information. Therefore, the key 
idea is to first use the secure link to build common randomness at Alice and Bob and 
subsequently use this common randomness to send information over the insecure link 
at a lower rate. 

2. Having access to the coded outputs (Vi, V 2 ) from Helen and the source X, Alice jointly 
quantizes (X,Vi,V 2 ) to an auxiliary random variable U. She subsequently performs 
Wyner-Ziv coding, i.e., bins the U sequences at the rate I(X;U\Vi,V 2 ,W) such that 
Bob can decode U by using W and the coded outputs (Vi, V 2 ) from the helper. 
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3. She also bins the source X at a rate H(X\U,Vi,V2,W) so that having access to 
(U,Vi,V 2 ,W), Bob can correctly decode the source X. The total rate used by Al- 
ice is I(X; U\V U V 2 , W) + H(X\U, Vi, V 2 , W) = H(X\Vi, V 2 , W). 

We note here that using Theorem 3, we can recover Theorem 2 by setting R ins = 0, and 
selecting W = Z = V 2 = 4>. 

On setting R sec = 0, the resulting model is similar to the one considered in [11] although 
the aim in [11] is to generate a secret key to be shared by Alice and Bob, while we are 
interested in the secure transmission of the source X. 

If R sec = R ins = 0, then we recover the result of [7] as a special case by setting V\ = V 2 = 
<p. Therefore, Theorem 3 can also be viewed as a generalization of the result of [7] where 
no rate constraint is imposed on the transmission of Alice and the goal is to maximize the 
uncertainty at Eve while losslessly transmitting the source to Bob. 

8 Conclusions 

In this paper, we considered several secure source coding problems. We first provided the 
characterization of the rate-equivocation region for a secure source coding problem with 
coded side information at the legitimate user. We next generalized this result for two different 
models with increasing complexity. We characterized the rate-equivocation region for the 
case of two-sided helper. The value of two-sided coded side information is emphasized by 
comparing the respective equivocations for a pair of binary sources. It is shown for this 
example that Slepian-Wolf type coding alone is insufficient and using our achievable scheme, 
one attains strictly larger uncertainty at the eavesdropper than the case of one-sided helper. 
We next considered the case when there are both secure and insecure rate-limited links from 
the helper and characterized the rate-equivocation region. 

9 Appendix 

9.1 Proof of Theorem [I] 
9.1.1 Achievability 

Fix the distribution p(x, y, v) = p(x, y)p{y\y). 

1. Codebook generation at Helen: From the conditional probability distribution p(v \y) 
compute p(v) = ^ y p(y)p(v\y). Generate 2 nI ^ V]Y ^ codewords v(l) independently ac- 
cording to nr=i^( t 'i)' wnere J = 1, • • • , 2 nI ( y ' Y K 

2. Codebook generation at Alice: Randomly bin the x n sequences into 2 nH( - x ^ bins and 
index these bins as m — 1, . . . , M, where M = 2 nH ^ x]{V \ 
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3. Encoding at Helen: On observing the sequence y n , Helen tries to find a sequence v(l) 
such that (v(l),y n ) are jointly typical. From rate-distortion theory, we know that 
there exists one such sequence as long as R y > I(V; Y). Helen sends the index / of the 
sequence v(l). 

4. Encoding at Alice: On observing the sequence x n , Alice finds the bin index m x in 
which the sequence x n falls and transmits the bin index mx- 

5. Decoding at Bob: On receiving / and the bin index mx, Bob tries to find a unique x n 
sequence in bin mx such that (v(l),x n ) are jointly typical. This is possible since the 
number of x n sequences in each bin is roughly 2 nH ( x ' ) /2 nH ( x \ v " > which is 2 nI ^ x ' ,v ^ and 
the existence of a unique x n such that (v(l),x n ) are jointly typical is guaranteed by 
the Markov lemma [16]. 

6. Equivocation: 

H(X n \m x ) = H(X n , m x ) - H(m x ) (40) 
= H(X n ) + H(m x \X n ) - H(m x ) (41) 
= H(X n ) - H(m x ) (42) 
> H(X n ) - log(M) (43) 
= H(X n ) -nH{X\V) (44) 
= nI(X; V) (45) 

Therefore, 

A < I(X; V) (46) 
is achievable. This completes the achievability part. 
9.1.2 Converse 

Let the output of the helper be J y , and the output of Alice be J x , i.e., 

Jy = fy(Y n ) (47) 
J x = f x (X n ) (48) 

First note that, for noiseless reconstruction of the sequence X n at the legitimate decoder, 
we have by Fano's inequality 

H(X n \J x , J y ) < ne n (49) 
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We start by obtaining a lower bound on R x , the rate of Alice, as follows 

nR x > H{J X ) (50) 

> H(j X \jy) (51) 

= H(X n , J x \J y ) - H(X n \J x , Jy) (52) 
>H(X n ,J x \J y )-ne n (53) 
>H(X n \J y )-ne n (54) 

n 

= Y,H(X l \X l - 1 ,J y )-ne n (55) 
i=i 

n 

= Y,H{X l \V i )-ne n (56) 

i=l 

= nH(X Q \V Q ,Q)-ne n (57) 
= nH(X\V) -ne n (58) 

where ( 1531) follows by ( )49l) . In ( 1561) . we have defined 

V i = (J y ,X l ~ 1 ) (59) 

In ( |58l) . we have defined, 

X = X Q , K = (Q,V ) (60) 

where Q is uniformly distributed on {l,...,n} and is independent of all other random 
variables. 

Next, we obtain a lower bound on R y , the rate of the helper, 

nR y > H{J y ) (61) 
>I(J y ,Y n ) (62) 

n 

= X)j(J w ,y 4 - 1 ;y < ) (63) 
1=1 

n 

= ^/(J^r- 1 ,^- 1 ;^) (64) 



1=1 



^^/(J,,^- 1 ;^) (65) 

i=l 
ri 

= £)/(V 4 ;y i ) (66) 



i=i 
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nI(V Q ;Y Q \Q) (67) 
nI(V;Y) (68) 



where ( I64p follows from the Markov chain 

X 1 - 1 ^{Jy^-^^Y, (69) 

and in (168]) . we have defined Y — Yq. 

We now have the main step, i.e., an upper bound on the equivocation rate of the eaves- 
dropper, 

H(X n \J x ) = H(X n , J y \J x ) - H(J y \X n , J x ) (70) 
= H(J y \J x ) - H(J y \X n , J x ) + H(X n \J x , Jy) (71) 

= H(jy\J X ) - H(jy\X n ) + H(X n \J X , Jy) (72) 
<H(jy)-H(jy\X n )+H(X n \J X ,Jy) (73) 

< I{J y - X n ) + ne n (74) 

n 

= J2HJy^ i \X l - 1 ) + ne n (75) 
i=i 

n 

= J2 I (Jy,X i - 1 ;X i ) + ne n (76) 
i=i 

n 

= ^/(X^)+ne n (77) 

i=l 

= nI(X Q ;V Q \Q) + ne n (78) 
= nI(X; V) + ne n (79) 

where f )72p follows from the Markov chain 

J x - X™ -> J, (80) 

and (1741) follows from (T49]). This implies 

A</(X;1/) (81) 

Also note that the following is a Markov chain, 

V -> y -> X (82) 
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Therefore, the joint distribution of the involved random variables is 

p(x, y, v) = p(x, y)p(v\y) (83) 

From support lemma [17], it can be shown that it suffices to consider such joint distributions 
for which |V| < \y\ + 2. 

9.2 Proof of Theorem [2 
9.2.1 Achievability 

Fix the distribution p(x, y, v) = p(x, y)p(v\y)p(u\x, v). 

1. Codebook generation at Helen: From the conditional probability distribution p(v\y) 
compute p(v) = Yl,yP(y)p( v \y)- Generate 2 nI ( y ' Y * ) codewords v(l) independently ac- 
cording to YYi=iP( v i)^ where 1 = 1,..., 2 nI ( V]Y \ 

2. Codebook generation at Alice: From the distribution p{u\x,v), compute p(u). Gen- 
erate 2 nI ( x ' V]U * > sequences u(s) independently according to YYi=iP( u i)-> where s = 
1, . . . , 2 nI<yX,v ' ,u \ Next, bin these sequences uniformly into 2 n/ ( X;C/ l v/ ) bins. 

Also, randomly bin the x n sequences into 2 nH ^ x ^ u ' v ^ bins and index these bins as 
m = l,...,2 nH W u > v >. 

3. Encoding at Helen: On observing the sequence y n , Helen tries to find a sequence v(l) 
such that (v(l),y n ) are jointly typical. From rate-distortion theory, we know that there 
exists one such sequence. Helen sends the index / of the sequence v(l). 

4. Encoding at Alice: The key difference from the one-sided helper case is in the encoding 
at Alice. On observing the sequence x n , Alice first finds the bin index mx in which 
the sequence x n falls. Alice also has the sequence v(l) received from Helen. Alice next 
finds a sequence u such that (u, v (l),x n ) are jointly typical. Let the bin index of this 
resulting u sequence be su- 

Alice transmits the pair (sjj, mx) which is received by Bob and Eve. The total rate 
used by Alice is I(X; U\V) + H(X\U, V) = H{X\V). 

5. Decoding at Bob: On receiving the pair (su, mx) from Alice and the index I from Helen, 
Bob first searches the bin su for a sequence u such that (u,v(l)) are jointly typical. 
This is possible since the number of u sequences in each auxiliary bin is approximately 
2 ni(x,v-,u) i 2 ni{x-,u\v) is 2 ni(U;V) and therefore with high probability, Bob will be 

able to obtain the correct u sequence. 

Using the estimate u and v(l), Bob searches for a unique x 11 sequence in the bin mx such 
that (u, v(l), x n ) are jointly typical. This is possible since the number of x n sequences 
in each bin is approximately 2 nH ^ /2 nH ^ u ' v ^ which is 2 nI( - u ' v ' x \ 
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6. Equivocation: 



H(X n \ Su , m x ) = H(X n , m x , s v ) - H{m x , Su ) (84) 

= H(X n ) + H(m x , Su \X n ) - H(m x , s v ) (85) 

= H{X n ) + H( Su \X n ) - H(m x , Su ) (86) 

> H(X n ) + H( Su \X n ) - H( Su ) - H{m x ) (87) 
= H(X n ) - H{m x ) - I(s u; X n ) (88) 

> H(X n ) -nH(X\U,V) - I(su;X n ) (89) 
= nI(X; U, V) - I( SU ] X n ) (90) 

> nI(X; U, V) - I{U n ; X n ) (91) 

> nI(X; U, V) - nI(U; X) (92) 
= nI{X;V\U) (93) 
>nmm(I(X;V\U),R y ) (94) 



where (1561) follows from the fact that m x is the bin index of the sequence X n , (1571) 
follows from the fact that conditioning reduces entropy, (1591) follows from the fact 
that H(m x ) < \og(2 nH ^ x \ u ' v ">), flE]) follows from the fact that s v is the bin in- 
dex of the sequence U n , i.e., su — > U n — > X n forms a Markov chain and subse- 
quently using the data processing inequality. Finally, ( 1941) follows from the fact that 
min(J(X; V\U), R y ) < I(X; V\U). We therefore have 

A < min(/(X; V\U), R y ) (95) 

is achievable. This completes the achievability part for the case of two-sided helper. 



9.2.2 Converse 

The only difference in the converse part for the case of two-sided helper is when deriving an 
upper bound on the equivocation rate of the eavesdropper: 

H{X n \J x ) = H(X n , J y \J x ) - H(J y \X n } J x ) (96) 
= H(J y \J x ) - H(J y \X n , J x ) + H(X n \J x , J y ) (97) 
< I{X n - J y \J x )+ne n (98) 

n 

= J2HX i ;J y \J x ,X i - 1 )+ne n (99) 
i=i 

n 

= HX* J yi X^J^ X'- 1 ) + ne n (100) 
i=i 

= nI(X;V\U) +ne n (101) 
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where we have defined 



V i = {J y ,X i - 1 ) (102) 
U i = (J x ,X*- 1 ) (103) 



and 



We also have, 



X = X Q , Y = Yq, V=(Q,V q ), U=(Q,U q ) (104) 



H(X n \J x ) = H(X n , J y \J x ) - H(J y \X n , J x ) (105) 

= H(jy\J X ) ~ H(jy\X n } J X ) + H(X n \J X , Jy) (106) 

< H{J y \J x )+nt n (107) 

< H(J V ) + ne n (108) 

< nR y + ne n (109) 



This implies 



A < min(/(X; V\U), R y ) (110) 
The joint distribution of the involved random variables is as follows, 

p out (x,y,v,u) =p(x,y)p(v\y)p out ( y u\x,v,y) (111) 

Note that in the achievability proof of Theorem 2, joint distributions of the following form 
are permitted, 

p ach (x, y, v, u) = p(x, y)p(v\y)p ach (u\x, v) (112) 

i.e, we have the Markov chain, Y — > (X, V) — > U . With the definition of V and U as in 
(I102l) - fll03p . these random variables do not satisfy this Markov chain. This implies that what 
we have shown so far is the following, 

7^-2- sided Q T^out (H3) 
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where 

U out = {(R x ,R y ,A) : R x > H{X\V) (114) 

Ry>I(Y;V) (115) 

A <mm(I(X;V\U),R y )j (116) 

where the joint distribution of the involved random variables is as given in fillip . 

However, we observe that the term I(X; V\U) depends only on the marginal p out (u\x, v). 
Similarly, the terms H(X\V) and I(X;V) depend only on the marginal p(x, v). We use 
these observations to show that the region TZ ou t is the same when it is evaluated using the 
joint distributions of the form given in (11121) . This is clear by noting that once we are given 
a distribution of the form given in (lllll) . we can construct a new distribution of the form 
given in (11121) with the same rate expressions. Consider any distribution p out (x,y,v,u) of 
the form given in (II lip . Using p out (x,y,v,u), compute the marginal p out (u\x,v) as, 

out, i \ J2 y p out (x,y,u,v) 

P (U\X,V) = -. r (117) 

p[x,v) 

We now construct a distribution p ach (x,y,v,u) G V ac h as, 

p ach {x, y, v, u) = p{x, y)p(v\y)p out (u\x, v) (118) 

such that the terms I(X; V\U), H(X\V) and /(X; V) are the same whether they are evalu- 
ated according to p out (x, y, v, u) or according to p ach (x, y, v, u). Therefore, we conclude that 
it suffices to consider input distributions satisfying the Markov chain Y — > (X, V) — > U when 
evaluating lZ out and hence 1Z out = 7Z a ch- This completes the converse part. We remark here 
that this observation was useful in obtaining the converse for the rate-distortion function 
with common coded side information [12], [13], [14]. 

9.3 Proof of Theorem [3] 
9.3.1 Achievability 

Fix the distribution p(x, y, w, z, v±, v 2 , u) = p(x, y)p(w, z\x)p(vi, v 2 \y)p(u\x, Vi, v 2 ). 

1. Codebook generation at Helen: From the conditional probability distribution p(v i, v 2 \y) 

compute p(v{) = T,(y, V2 )P(y)p( v ^ v ^y) and p(w 2 ) = E^) p(v)p( v u v 2 \y). Generate 
2ni(y 1 ;Y) se q Uences vi(l) independently according to Yli=i P( v u), where 1 = 1,..., 2 n/ ( Vi;y ) 
Bin these sequences uniformly and independently in 2 n ( I ( Vv ' Y )~ I ( Vv ' w >) bins. Denote the 
bin index of the sequence v\(l) as bv 1 (vi(l)). 

Next generate 2 nI ^ V2 ' Y ' Vl ^ sequences v 2 (j) independently according to Y\^ = iP{v 2 i), where 
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j = 1, . . . , 2 nI ( V2 ' Y ' Vl \ Bin these sequences uniformly and independently in 
2 n(i{v 2 ;Y,v 1 )-i(v 2 ;W,v 1 )) bing> Denote t ^ e bin index of the sequence v 2 (j) as b V2 (v 2 (j)). 

2. Codebook generation at Alice: From the distribution p(u\x, v±, v 2 ), compute p(u). Gen- 
erate 2 nI ( x ' Vl ' Vr ' u ^ sequences u(s) independently according to YYi=iP( u i)i where s = 
1, . . . , 2 nI( - x > Vl > Vr ' u \ Next, bin these sequences uniformly into 2<^ xyi ' w ^-^ w ' Vl ^ u ^ 
bins. 

Also, randomly bin the x n sequences into 2 nH ^ x ^ u ' Vl,V2 ' w ^ bins and index these bins as 
m = 1, . . ,^2 nH( - x \ u ' VuV2 ' w \ 

3. Encoding at Helen: On observing the sequence y n , Helen tries to find a sequence v±(l) 
such that (vi(l),y n ) are jointly typical. From rate-distortion theory, we know that 
there exists one such sequence. Helen sends the bin index 6y 1 (fi(/)) of the sequence 
Vi(l) on the secure link which is received by Alice and Bob. 

Helen also finds a sequence v 2 (j) such that (v 1 (l),v 2 (j),y n ) are jointly typical. From 
rate-distortion theory, we know that there exists one such sequence. Helen sends the 
bin index bv 2 {v 2 (j)) of the sequence v 2 (j) on the insecure link which is received by 
Alice, Bob and Eve. 

4. Encoding at Alice: On observing the sequence x n , Alice first finds the bin index mx in 
which the sequence x n falls. Alice also receives the bin indices bv 1 (vi(l)) and bv 2 (v 2 (j)) 
from Helen. She first looks for a unique Vi(l) in the bin by 1 (vi(l)) such that (x n ,Vi(l)) 
are jointly typical. Alice can estimate the correct sequence vi(l) as long as the num- 
ber of sequences in each bin is less than 2 nI<yX ' ,Vl \ Note from the codebook gener- 
ation step at Helen, that the number of v\ sequences in each bin is approximately 

2 nI(V 1 ;Y)/ 2 n(I(V 1 ;Y)-I(V 1 ;W)) = 2 nI(Vy,W) _ g ince ^ _, X _^ yy forms & Markoy ( j hain> we 

have I(Vi; W) < I(Vi, X) and therefore the number of Vi sequences in each bin is less 
than 2 nI ( X;Vl ^ and consequently Alice can estimate the correct sequence v±(l). 

Using x n and vi(l), Alice looks for a unique v 2 (j) in the bin bv 2 (v 2 (j)) such that 
(x n , vi(l), v 2 (j)) are jointly typical. Alice can estimate the correct sequence v 2 (j) as 
long as the number of sequences in each bin is less than 2 nI ( x > Vl ' V2 \ The number of 
v 2 (j) sequences in each bin is 2 nI ^ w ' Vl ' V2 \ From the Markov chain W — > X — >■ (Vi, V 2 ), 
we have I(W,Vi,V 2 ) < I(X, V\,V 2 ) and therefore Alice can correctly estimate the 
sequence v 2 (j). 

She next finds a sequence u such that (u, Vi(l), v 2 (j), x n ) are jointly typical. Let the 
bin index of this resulting u sequence be sjj. 

Alice transmits the pair (su,mx) which is received by Bob and Eve. The total rate 
used by Alice is I(X; U\V U V 2 , W) + H(X\U, V u V 2 , W) = H(X\V 1} V 2 , W). 



21 



5. Decoding at Bob: On receiving the pair (sjj,m x ) from Alice and the bin indices 
b Vl (v 1 (l)) and bv 2 (v 2 (j)) from Helen, Bob looks for a unique V\{1) in the bin byiviil)) 
such that {w n ,v\{l)) are jointly typical. He can estimate the correct sequence vi(l) 
with high probability since the number of v\ sequences in each bin is approximately 
2ni(Vv,w) _ xj s i n g estimate v±(l) and w n , he looks for a unique v 2 (j) m the bin 
bv 2 ( v 2(j)) such that (w n , Vi(l)) , v 2 (j)) are jointly typical. With high probability, the 
correct sequence v 2 (j) can be decoded by Bob since the number of v 2 sequences in each 
bin is approximately 2 nI ^ V2]W ^ Vl \ 

He next searches the bin su for a sequence u such that (u, vi(l), V2U), w n ) are jointly 
typical. Since the number of u sequences in each auxiliary bin is approximately 
2 ni(x,v 1 ,vr,u)/ 2 n(i(x,v 1 ,vr,u)-i(w,v 1 ,vr,u)) wmc h is 2 nI ( w > v ^ u \ with high probability, Bob 
will be able to obtain the correct u sequence. 

Using the estimates it, Vi(l), and v 2 (j), Bob searches for a unique x n sequence in 
the bin m x such that (it, vi(l), V2U), w n , x n ) are jointly typical. This is possible since 
the number of x n sequences in each bin is approximately 2 nH( - x ^ /2 nH( - x ^ u ' Vl ' V2 ' w \ i.e., 
2ni{u,Vi,v 2 ,W;X) ^ Therefore, Bob can correctly decode the x n sequence with high proba- 
bility. 

6. Equivocation: 

H(X n \ Su , m x , b V2 , Z n ) = H(X n , m x , s v , b V2 \Z n ) - H(m x , Su , by 2 \Z n ) (119) 

= H(X n \Z n ) + H(m x , Su , b V2 \X n , Z n ) - H(m x , s v , by 2 \Z n ) 

(120) 

= H(X n \Z n ) + H{ Su , b V2 \X n , Z n ) - H(m x , s v , by 2 \Z n ) (121) 

> H{X n \Z n ) + H( Su ,b V2 \X n , Z n ) - H(m x \Z n ) 
-H{ Su ,b V2 \Z n ) (122) 

> H{X n \Z n ) + H{ Su ,b V2 \X n , Z n ) - H(m x ) 
-H{ Su ,b V2 \Z n ) (123) 

> H(X n \Z n ) + H( Su , b V2 \X n , Z n ) - nH(X\U, V u V 2 , W) 
-H( Su ,b V2 \Z n ) (124) 

= H{X n \Z n ) - I{ Su , b V2 ;X n \Z n ) - nH{X\U, V u V 2 , W) 

(125) 

> H(X n \Z n ) - I(U n , V£; X n \Z n ) - nH(X\U, V u V 2 , W) 

(126) 

> H(X n \Z n ) - nI(U, V 2 ; X\Z) - nH(X\U, V u V 2 , W) (127) 
= nH{X\Z) - nI(U, V 2 ; X\Z) - nH(X\U, V u V 2 , W) (128) 
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= n{H{X\U, V 2 , Z) - H{X\U, V u V 2 , W)) (129) 

= n{I{X; VtlU, V 2 , W) + /(X; W\U, V 2 ) - J(X; Z\U, V 2 )) (130) 
> n(mm(R sec , I(X; V^U, V 2 , W)) + /(X; W\U, V 2 ) 

-I(X;Z\U,V 2 )) (131) 

where f)12ip follows from the fact that m>x is the bin index of the sequence X n , (11221) 
and (I123p follow from the fact that conditioning reduces entropy, (I124p follows from the 
fact that H(m x ) < \og(2 nH{ ~ x \ u > v ^ V2 > w ^), fTT26|) follows from the fact that s v is the bin 
index of the sequence U n and by 2 is the bin index of the sequence V 2 . This completes 
the achievability part. 



9.3.2 Converse 

Let the coded outputs of the helper be denoted as (J sec , 4s), where J sec denotes the coded 
output of the secure link, J ins denotes the coded output of the insecure link, and the output 
of Alice be denoted as J x , i.e., 

(yJsea Jins 

) = f y {Y n ) and J x = f x (X n 

i Jseci Jins ) (132) 

First note that, for noiseless reconstruction of the sequence X n at Bob, we have by Fano's 
inequality 

H(X n \J x , J sec , J inS} W n ) < ne n (133) 

We start by obtaining a lower bound on R x , the rate of Alice, as follows, 

nR x > H{J X ) (134) 

>H(J x \J seC} J mS} W n ) (135) 

= H(X n , J x \J sec , Jins, W n ) — H(X n \J x , J sec , J ins , W n ) (136) 

> H(X n , J x \J sec , J ms , W n ) - ne n (137) 

> H(X n \ J sec , J ins , W n ) - ne n (138) 



= J] if (XIX- 1 , J sec , J ins ,W n ) -ne n (139) 
= J2 H ( X i\ J sec J in s,X'-\W^W l ) -ne n (140) 

8=1 

n 

> H(X,\J sec , J ms , Y l ~\ X l ~\ WP +lJ Wi) - ne n (141) 



i=i 
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= J2 H(Xi\Vu, V 2i , Wi) - ne n (142) 

i=i 

= nH(X\V 1 ,V 2 ,W)-ne n (143) 
where (11371) follows by ( 1 133ft and (1140p follows from the following Markov chain, 

W" 1 -> ( J sec , J ins , X*" 1 , Wi) -> X, (144) 

In (11421) . we have defined 

v af = (j« c ,y i - 1 ,x i - 1 ,wj; 1 ) (145) 

V 2i = J ms (146) 
We next obtain a lower bound on R sec , the rate of the secure link, 

nR sec > H(J sec ) (147) 

> H(J sec \W n ) (148) 

> I(J sec ;Y n \W n ) (149) 

= HJsec, Y l ~\ W'-\ W? +1 ; Yi\Wi) (150) 

i=\ 
n 

= HJsec, Y*- 1 , WP +1 ; Yi\Wi) (151) 

i=l 
n 

= £ I(J sec , Y'-\ X'-\ Wr +1 ; Yi\Wi) (152) 



i=l 



^IiVtfYilWi) (153) 



i=l 



= nI{Vr,Y\W) (154) 
where (11511) and (11521) follow from the Markov chain 

(X*- 1 , W 1 - 1 ) - ( J sec , Y l ~\ W? +1 ) - (155) 
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Next, we provide a lower bound on Ri ns , the rate of the insecure link, 

nR ins > H(J ins ) (156) 

>H(J ins \J sec ,W n ) (157) 

> H(J ins \J sec ,W n ) -H(J ins \J sec ,Y n ) (158) 

= I(J ms ; Y n \J sec ) - I{J ms - W n \J sec ) (159) 

n 

= ^HJins^J^Y^^W^) -HJinslWilJ^Y*- 1 ,^) (160) 

i=l 
n 

= £ HJins] YUsec, Y l -\ X'-'W^) - I{J ins - Wi\J sec , Y 4 - 1 , X'-\ W t n +1 ) (161) 
1=1 

n 

= J2 KYx; Yi\V u ) - I(V 2t ; W t \V lt ) (162) 

n 

= Y, I ^nW i ,V li ) (163) 
1=1 

= nI{V 2 ;Y\W,V 1 ) (164) 

where (11601) follows from the Csiszar's sum lemma [17], and f II 6 1 j) follows from the following 
Markov chain, 

X 1 - 1 - ( J sec , Y l ~\ W? +1 ) - ( J ins , Y, Wi) (165) 

We now have the main step, i.e., an upper bound on the equivocation rate of the eaves- 
dropper, 

H(X n \ J x , J ins , Z n ) = H(X n , Z n \J x , J ins ) — H(Z n \J x , J ins ) (166) 

= H(X n , W n , Jgec, Z n \J x , Ji ns ) — H(Z n \J x , Jins) 

- H(W n , J sec \X n , Z n , J x , J ms ) (167) 

= H(W", J S ec\J X , Jins) + H(X n \W n , J x , Jsec, Jins) + H(Z n \X n , W U ) 

- H(Z n \J x , J ms ) - H(W n \X n , Z n ) - H(J S ec\X n , J x , J ins , W n ) (168) 
= (H(W n \J x , J ms ) - H(Z n \J x , J ms )) - (H(W n \X n , Z n ) 

- H(Z n \X n , W n )) + I(Jse C ; X n \J x , J ms , W n ) 

+ H(X n \W n ,J x ,J sec ,J ins ) (169) 
< (H(W n \ J x , J ms ) - H(Z n \J x , J ms )) - (H(W n \X n , Z n ) 

- H(Z n \X n , W n )) + I(Jsec, X n \J x , J ins , W n ) + ne n (170) 

where (1IB81) follows from the Markov chain Y n -> X n -> (W n ,Z n ) and (0701) follows by 
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(11331) . Now, using Csiszar's sum lemma [17], we have 

n 

H(W n \J x , J ms ) - H(Z n \J x , J ins ) = ^ H{W t \Z*~\ W? +1 , J x , J ins ) 

i=\ 

■n 

- HiZ^Z'- 1 , W? +1 , J x , J ins ) (171) 
i=l 

and we also have, 

H{W n \X n , Z n ) - H(Z n \X n , W n ) = H(W n \X n ) - H{Z n \X n ) (172) 

n n 

= H(Wi\Xi) - H(Zi\Xi) (173) 

n 

= H{W,\X h Z l ~\ W? +1 , J x , J ms ) 

n 

-Y^ H i Z i\ X ^ Zi ~^ W i+X^^Jins) (174) 
i=l 

where (j!73p follows from the memorylessness of the sources and (I174p follows from the 
Markov chain Y n -> X n -> (W™, Z n ). Now, defining, 

^ = (J 3! ,^ < - 1 ,W^ 1 ) (175) 

and 

X = X Q , Y = Yq, Z = Z q , W = W q (176) 

Vi = (Q,V 1Q ), V 2 = (Q,V 2Q ), U=(Q,U Q ) (177) 

we have from (I17ip and (11741) . 

H(W n \J x , J ms ) - H(Z n \J x , J ms ) = n(H(W\U, V 2 ) - H(Z\U, V 2 )) (178) 
H{W n \X n , Z n ) - H{Z n \X n , W n ) = n{H{W\X, U, V 2 ) - H{Z\X, U, V 2 )) (179) 
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Now consider, 

n 

I {J sect X \Jxi Jinsi ^W ) ^ ^ I [J sea X{ \Jxi Jinsi ^W , X ) 

i=l 

n n 
= -f^(^il^) Jins, W n , X % X ) — H(Xi\J x , J ins , J Sl 



We also have 



i=i i=i 



i+ij 



= H(Xi\J x , J ms , Wi, X 1 - 1 , WP +1 ) 

i=l 

n 

- y ^2,H(X i \J x , J ins , J sec , Wi,X l ~ l , W? +1 ) 
i=i 

n 

= H(Xi\J x , J ins , X 1 - 1 , Z 1 - 1 , W? +1 ) 
i=i 

n 

— H(Xj\J x , Jj ns , J sec , Wj, X 1 l ,Z l 
1=1 

n 

< J] H(Xi\ J x , J ms , W h Z*-\ W? +1 ) 
i=i 

n 

— H(Xj\J x , J ins , J sec , Wi, X 1 l ,Z l 1 ,W™ +1 ) 
i=l 

n 

< H(Xi\J x , J ms , W h Z?-\ W? +1 ) 

i=l 

n 

- H{Xi\J x , J ms , J sec , W h X*-\ Y*- 1 , Z*-\ W? +1 ) 

i=l 

n n 

= H{Xi\Ui, Wi, V 2i ) - H{Xi\Ui, Wi, V 2i , V u ) 

i=l i=l 
n 

= Y,I(X i ;V li \W i ,U i ,V 2i ) 
i=i 

= nI(X;V 1 \W,U,V 2 ) 



I\JseciX | J x , Ji n s, W ) <J H \Jsee) 

^ TlR sec 

Therefore, we have 

/( J sec ; X n \J x , J ins , W n ) < n mm(R sec , /(X; V,\W, U, V 2 )) 

27 



Finally, on substituting (TTT81 . (fT79|) and (TT9H in (TTTOl . we arrive at 



H(X n \J x , J ins , Z n ) < n(mm(R sec , I(X; V 1 \W ) U, V 2 )) + /(X; W\U, V 2 ) - I(X; Z\U, V 2 ) + e n ) 

(192) 

This implies 

A < min(i2 sec , I(X; V X \W, U, V 2 )) + I(X; W\U, V 2 ) - I(X; Z\U, V 2 ) (193) 
Also note that the following is a Markov chain, 

(V U V 2 )^Y^X^(W,Z) (194) 
Therefore, the joint distribution of the involved random variables is 

p ou \x, y, w, z, vi, v 2 , u) = p(x, y)p(w, z\x)p(vi, v 2 \y)p(u\x, v x , v 2 , y) (195) 

On the other hand, the joint distribution of the involved random variables in the achievability 
proof of Theorem 3 is in the following form, 

p ach (x, y, w, z, vi, v 2 , u) = p(x, y)p(w, z\x)p(vi, v 2 \y)p(u\x, vi, v 2 ) (196) 

i.e., they satisfy the Markov chain Y —>■ (X,Vi,V 2 ) — > U. Now using the observation that 
I(X;W\U,Vx,V 2 ) depends on the marginal p(x, w, u, v i, v 2 ) and I(X; Z\U, Vi, V 2 ) depends 
on the marginal p(x, z, u, v i, v 2 ) and using similar arguments used in the converse proof of 
Theorem 2, it can be shown that it suffices to consider distributions of the form given in 
( 11961) when evaluating our outer bound. This completes the proof of the converse part. 
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